acdl/terraform/bootstrap/spike_runner_policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning"
      ],
      "Resource": [
        "arn:aws:s3:::nova-tfstate-581513795199-us-east-1",
        "arn:aws:s3:::nova-tfstate-581513795199-us-east-1/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem",
        "dynamodb:UpdateItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:DescribeTable"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/nova-outbox"
    },
    {
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:Create*",
        "ecs:Describe*",
        "ecs:Delete*",
        "ecs:Update*",
        "ecs:Register*",
        "ecs:Deregister*",
        "ecs:List*"
      ],
      "Resource": "arn:aws:ecs:us-east-1:581513795199:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:Create*",
        "ecr:Describe*",
        "ecr:Delete*",
        "ecr:Get*",
        "ecr:Batch*",
        "ecr:Put*",
        "ecr:Upload*",
        "ecr:Initiate*",
        "ecr:Complete*"
      ],
      "Resource": "arn:aws:ecr:us-east-1:581513795199:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:Create*",
        "elasticloadbalancing:Describe*",
        "elasticloadbalancing:Delete*",
        "elasticloadbalancing:Modify*",
        "elasticloadbalancing:Register*",
        "elasticloadbalancing:Deregister*"
      ],
      "Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:Create*",
        "iam:Get*",
        "iam:Delete*",
        "iam:PassRole",
        "iam:Attach*",
        "iam:Detach*",
        "iam:List*",
        "iam:Put*"
      ],
      "Resource": "arn:aws:iam::581513795199:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Create*",
        "ec2:Describe*",
        "ec2:Delete*",
        "ec2:Associate*",
        "ec2:Disassociate*",
        "ec2:Attach*",
        "ec2:Detach*",
        "ec2:Authorize*"
      ],
      "Resource": "arn:aws:ec2:us-east-1:581513795199:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudfront:Create*",
        "cloudfront:Describe*",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudfront:Update*",
        "cloudfront:Delete*",
        "cloudfront:TagResource",
        "cloudfront:UntagResource"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "wafv2:Create*",
        "wafv2:Describe*",
        "wafv2:Get*",
        "wafv2:List*",
        "wafv2:Update*",
        "wafv2:Delete*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:Create*",
        "lambda:Get*",
        "lambda:List*",
        "lambda:Update*",
        "lambda:Delete*",
        "lambda:InvokeFunction",
        "lambda:InvokeFunctionUrl",
        "lambda:TagResource",
        "lambda:UntagResource",
        "lambda:PublishLayerVersion"
      ],
      "Resource": "arn:aws:lambda:us-east-1:581513795199:function:nova-*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:Create*",
        "dynamodb:Describe*",
        "dynamodb:Get*",
        "dynamodb:Put*",
        "dynamodb:Update*",
        "dynamodb:Delete*",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:Batch*"
      ],
      "Resource": [
        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-contracts",
        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-contracts/*",
        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-change-requests",
        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-change-requests/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:CreateSecret",
        "secretsmanager:PutSecretValue",
        "secretsmanager:DeleteSecret",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:581513795199:secret:nova/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:Publish",
        "sns:GetTopicAttributes",
        "sns:SetTopicAttributes",
        "sns:DeleteTopic",
        "sns:ListTopics"
      ],
      "Resource": "arn:aws:sns:us-east-1:581513795199:nova-*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetCostAndUsageWithResources",
        "ce:GetDimensionValues",
        "ce:GetTags"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:CreateKey",
        "kms:CreateAlias",
        "kms:Describe*",
        "kms:Get*",
        "kms:List*",
        "kms:Update*",
        "kms:Delete*",
        "kms:EnableKey",
        "kms:DisableKey",
        "kms:ScheduleKeyDeletion",
        "kms:TagResource",
        "kms:UntagResource"
      ],
      "Resource": [
        "arn:aws:kms:*:*:key/*",
        "arn:aws:kms:*:*:alias/nova-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateOpenIDConnectProvider",
        "iam:GetOpenIDConnectProvider",
        "iam:DeleteOpenIDConnectProvider",
        "iam:ListOpenIDConnectProviders",
        "iam:UpdateOpenIDConnectProviderThumbprint",
        "iam:CreateRole",
        "iam:GetRole",
        "iam:ListRoles",
        "iam:DeleteRole",
        "iam:UpdateRole",
        "iam:TagRole",
        "iam:UntagRole"
      ],
      "Resource": "arn:aws:iam::*:role/nova-*"
    }
  ]
}